|
|
From eeef53917864600e0f5ac42ce5c3d884967012a1 Mon Sep 17 00:00:00 2001
|
|
|
From: =?UTF-8?q?Petr=20P=C3=ADsa=C5=99?= <ppisar@redhat.com>
|
|
|
Date: Mon, 5 Feb 2018 10:31:47 +0100
|
|
|
Subject: [PATCH 1/2] warnquota: Check snprintf() for overflows
|
|
|
MIME-Version: 1.0
|
|
|
Content-Type: text/plain; charset=UTF-8
|
|
|
Content-Transfer-Encoding: 8bit
|
|
|
|
|
|
GCC 8 with GNU libc 2.27 prerelease warns:
|
|
|
|
|
|
gcc -DHAVE_CONFIG_H -I. -g -O2 -Wall -fPIC -I/usr/include/tirpc -c -o warnquota.o warnquota.c
|
|
|
warnquota.c: In function ‘lookup_user’:
|
|
|
warnquota.c:415:29: warning: ‘%s’ directive output may be truncated writing up to 2047 bytes into a region of size 255 [-Wformat-truncation=]
|
|
|
snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user);
|
|
|
^~
|
|
|
warnquota.c:415:2: note: ‘snprintf’ output 4 or more bytes (assuming 2051) into a destination of size 256
|
|
|
snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user);
|
|
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
warnquota.c: In function ‘warn_quota’:
|
|
|
warnquota.c:896:51: warning: ‘%s’ directive output may be truncated writing up to 2047 bytes into a region of size 2041 [-Wformat-truncation=]
|
|
|
snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port);
|
|
|
^~ ~~~~~~~~~~~~~~~~~
|
|
|
warnquota.c:896:4: note: ‘snprintf’ output between 10 and 2067 bytes into a destination of size 2048
|
|
|
snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port);
|
|
|
^~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
|
|
|
|
This is patch fixes it by catching the cases when snprintf() truncates and
|
|
|
reporting an error.
|
|
|
|
|
|
Perfect fix would fall back into dynamically allocated buffers but
|
|
|
I think that would make these corner case too complicated provided
|
|
|
nobody had yet complained about them.
|
|
|
|
|
|
Signed-off-by: Petr Písař <ppisar@redhat.com>
|
|
|
---
|
|
|
warnquota.c | 17 +++++++++++++++--
|
|
|
1 file changed, 15 insertions(+), 2 deletions(-)
|
|
|
|
|
|
diff --git a/warnquota.c b/warnquota.c
|
|
|
index 073c45e..bc11055 100644
|
|
|
--- a/warnquota.c
|
|
|
+++ b/warnquota.c
|
|
|
@@ -412,7 +412,13 @@ static char *lookup_user(struct configparams *config, char *user)
|
|
|
}
|
|
|
|
|
|
/* search for the offender_name in ldap */
|
|
|
- snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr, user);
|
|
|
+ if (256 <= snprintf(searchbuf, 256, "(%s=%s)", config->ldap_search_attr,
|
|
|
+ user)) {
|
|
|
+ errstr(_("Could not format LDAP search filter for %s user and "
|
|
|
+ "%s search attribute due to excessive length.\n"),
|
|
|
+ user, config->ldap_search_attr);
|
|
|
+ return NULL;
|
|
|
+ }
|
|
|
ret = ldap_search_ext_s(ldapconn,
|
|
|
config->ldap_basedn, LDAP_SCOPE_SUBTREE,
|
|
|
searchbuf, NULL, 0, NULL, NULL, NULL,
|
|
|
@@ -893,7 +899,14 @@ cc_parse_err:
|
|
|
if (config->use_ldap_mail)
|
|
|
{
|
|
|
if (!config->ldap_uri[0]) {
|
|
|
- snprintf(config->ldap_uri, CNF_BUFFER, "ldap://%s:%d", config->ldap_host, config->ldap_port);
|
|
|
+ if (CNF_BUFFER <= snprintf(config->ldap_uri, CNF_BUFFER,
|
|
|
+ "ldap://%s:%d", config->ldap_host,
|
|
|
+ config->ldap_port)) {
|
|
|
+ errstr(_("Could not format LDAP URI because "
|
|
|
+ "it's longer than %d bytes.\n"),
|
|
|
+ CNF_BUFFER);
|
|
|
+ return -1;
|
|
|
+ }
|
|
|
errstr(_("LDAP library version >= 2.3 detected. Please use LDAP_URI instead of hostname and port.\nGenerated URI %s\n"), config->ldap_uri);
|
|
|
}
|
|
|
}
|
|
|
--
|
|
|
2.13.6
|
|
|
|
